Re: [http-state] Ticket 6: host-only cookies

[Dave Kristol <[e-mail]>]

Adam Barth wrote:
> On Tue, Feb 2, 2010 at 8:37 AM, Dave Kristol <[e-mail]> wrote:
>> Adam Barth wrote:
>>> I've added the following text to the server section, as recommend by
>>> Dan Winship:
>>>
>>>              <t>WARNING: Some legacy user agents treat an absent Domain
>>>              attribute as if the Domain attribute were present and
>>> contained
>>>              the current host name. For example, if example.com returns a
>>>              Set-Cookie header without a Domain attribute, these user
>>> agents
>>>              will send the cookie to www.example.com.</t>
>> If the implied Domain attribute is example.com, then the user agent may only
>> return the cookie to example.com.
> 
> Do you mean that
> 
> Set-Cookie: foo=bar; Domain=example.com
> 
> and
> 
> Set-Cookie: foo=bar; Domain=.example.com
> 
> are treated differently by user agents?  That might be true according
> to 2109 (I'd have to check), but I don't think that's how user agents
> work in practice.  They appear to ignore the leading dot.  If you have
> a test case that show a difference, I'd be very interested in seeing
> it.

That is what I meant, and I do not have a test case.  That is what 2109 
said, and I believe (though it's been many years now... ugh!) I adopted 
that from Netscape's spec.  Generally speaking, the idea was that, in 
the absence of Domain=, the cookie should be returned only to the server 
that sent it.

Dave Kristol